PIPEDA compliance: what it requires, and a checklist to work from
PIPEDA remains Canada’s operative federal privacy law in 2026 — the bill that would have replaced it died in Parliament and was never revived. Here’s what actually applies to your business, and a practical checklist to work through.
Who PIPEDA actually applies to
The Personal Information Protection and Electronic Documents Act governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activity. There’s no employee-count threshold — a five-person business handling customer data has the same core obligations as a national enterprise.
One provincial exception: Quebec’s Law 25 has been declared substantially similar to PIPEDA and applies instead of it for activity that occurs entirely within Quebec. PIPEDA still applies to federally regulated businesses operating in Quebec, and to any personal information that crosses a provincial or international border.
PIPEDA’s 10 principles, in practice
The Act is built around ten fair information principles. Here’s what each one actually asks of you operationally.
Accountability & openness
Someone in your organization has to actually own privacy compliance, and your policies need to be genuinely accessible — not just legally present.
- A named Privacy Officer, not just a policy that references one
- A public, plain-language privacy policy
Consent, purpose & limits
Collection has to be for an identified purpose, with meaningful consent, and limited to what that purpose actually requires — not whatever might be useful later.
- Consent that’s genuinely informed, not buried in fine print
- Collection, use, and retention all scoped to a stated purpose
Accuracy & safeguards
Information has to be kept accurate for its intended use, and protected with safeguards proportionate to how sensitive it actually is.
- A process for keeping records current
- Technical and physical safeguards matched to data sensitivity
Individual access & recourse
People have a right to see what you hold on them, correct it if it’s wrong, and challenge your compliance if they think you’ve fallen short.
- A working process to fulfill access requests
- A documented complaint-handling procedure
Breach notification isn’t optional, and the record-keeping rule catches people off guard
If a breach creates a “real risk of significant harm” (RROSH) — assessed by the sensitivity of the data and the likelihood it’s misused — you must report it to the Office of the Privacy Commissioner and notify affected individuals directly, “as soon as feasible.” The Act doesn’t name a fixed number of days, but the OPC expects action within days, not months.
The part that surprises people: you must keep an internal record of every breach of security safeguards for a minimum of 24 months — even ones that don’t meet the RROSH threshold and were never reported. Knowingly failing to report, notify, or keep these records is an offence carrying fines of up to $100,000 CAD per violation.
The three breach obligations
- Report to the OPC if RROSH is met
- Notify affected individuals directly if RROSH is met
- Keep an internal record of every breach for 24 months, RROSH or not
PIPEDA compliance checklist
Five areas, worked through in order. Treat gaps here as findings, not paperwork.
Governance & accountability
- Privacy Officer named and actually accountable, not nominal
- Public, plain-language privacy policy published
- Staff trained on privacy obligations and breach recognition
Consent & collection
- Personal information collected only for identified, documented purposes
- Meaningful consent obtained before collection, not implied by default
- Collection scoped to what the stated purpose actually requires
Safeguards
- Technical safeguards proportionate to data sensitivity — encryption, access control, MFA
- Due diligence documented for any third party or vendor that touches personal information
- Retention limits defined and actually enforced, not indefinite by default
Breach readiness
- Documented breach response plan with a defined RROSH assessment process
- Internal breach log capable of meeting the 24-month retention rule
- Clear, pre-agreed process for notifying the OPC and affected individuals without delay
Individual rights
- Working process for individuals to request and receive their own personal information
- Process for correcting inaccurate personal information on request
- Documented complaint-handling procedure individuals can actually use
Not sure your breach record-keeping would hold up?
Let’s walk through your current PIPEDA posture and find the gaps before the OPC does.
Talk to Us About PIPEDA Compliance